Secomea GateManager BASIC Guide Learning Secomea Remote Access

Transcription

1 Secomea GateManager BASIC Guide Learning Secomea Remote Access This guide is intended for first time users of the Secomea remote access solution, who have ordered a Secomea Starter Package This guide will lead you through different roles and processes related to installing and configuring the SiteManager, GateManager Administration of users and using LinkManager. Version: 1.3. march 2015 Secomea GateManager5 BASIC Guide Page 1 of 26

2 Table of Contents 1. Introduction Prerequisites for This Guide Component Analogies About Roles referred to in this Guide: Illustration of Role locations If something should not work out as expected 5 2. ROLE: SiteManager Installer Configure GateManager settings using the Appliance Launcher Deciding a Device connection method ROLE: GateManager BASIC Admin Install the GateManager Administrator certificate Create LinkManager user ROLE: LinkManager User Install the LinkManager Connect to the SiteManager GUI Configure the SiteManager Network settings Configure the SiteManager Device Agent Summary Upgrading your GateManager Administrator account from BASIC to PREMIUM (P/N 26473) 25 Notices 26 Secomea GateManager5 BASIC Guide Page 2 of 26

3 Introduction 1. Introduction 1.1. Prerequisites for This Guide Prerequisites for this guide are: You have administrator privileges to install a program on your Windows PC or laptop. Preferably you are located in a network that assigns IP addresses by DHCP (also for equipment other than PCs). Your PC has outgoing access to the Internet via https. This applies for both your corporate firewall and any personal firewall installed on your PC. You have received a SiteManager hardware appliance. You have access to a spare port on an Ethernet switch or wall outlet to which you can connect the SiteManager (can be on the same network as your PC, but could also be in another network, as long as it has outgoing access to the Internet). Alternatively the Uplink2 b connection can be used. You have a network enabled device in your network that you can use as remote monitored device. This could be a PLC or similar or just a web enabled network device, such as your workgroup printer. You have received, by , a GateManager certificate with a link to the web based GateManager administrator portal. Preferably you have a login account for the Secomea partner web site, for download of supplementary information on (if not choose Register at the top right of the Secomea web site) Component Analogies With the Secomea Remote Access solution you are introduced to three components. To place them into a context that you may be familiar with, we have made analogies to traditional modem solutions: SiteManager Hardware appliance. This compares to the traditional dial-up modem attached to the machine at the customer site. The big difference is that one SiteManager can provide access to multiple machines (both IP, Serial and selected USB devices), and it can utilize the existing network infrastructure to obtain Internet connection (some models also support 3G). LinkManager Client Software. This compares to the modem dial-up software on the service engineers PC. The big difference is that the service engineer does not need to administer a list of phone numbers. The list of devices that the service engineer can connect to, is automatically updated when a new SiteManager is connected, and when the SiteManager is configured with new device agents. Point and click and the LinkManager user get instant access to the device over the Internet. GateManager Server. This component acts as a switch-board for connections between LinkManagers and SiteManagers, and ensures that neither LinkManagers nor SiteManagers need to have public addresses on the Internet. For the BASIC package the GateManager is used only for administering users, but you can upgrade to a domain administrator account that allows you to check logs, fine grain LinkManager access to certain devices etc. (read more in section 6. Upgrading your GateManager Administrator account from BASIC to PREMIUM (P/N 26473)). Secomea GateManager5 BASIC Guide Page 3 of 26

4 Introduction 1.3. About Roles referred to in this Guide: Through the document the header will indicate the role you are undertaking. Roles will be marked as follows: SiteManager Installer This role covers the following tasks: Physically Install SiteManagers (often done by the service engineer or the customer). Configure network settings (primarily initial GateManager access). Optionally configure device agents on the SiteManager, if not done by the LinkManager user. GateManager BASIC administrator This role covers the following tasks: Creating and administering LinkManager user accounts. LinkManager User This role is held by the PLC programmer or service engineer: Connect remotely to equipment for servicing/programming the equipment. Optionally configure the SiteManager and device agents on the SiteManager, if not done by the SiteManager Installer role Illustration of Role locations The typical setup of the relative to the Internet would be like this: GateManager Server LinkManager User SiteManager Installer GateManager Administrator Secomea GateManager5 BASIC Guide Page 4 of 26

5 Introduction However, following this guide for the first time, you will probably play all roles and be physically located more like this: 1.5. If something should not work out as expected We experience that this guide works for 95% of all users, whereas the last 5% may be subject for a little more advanced configurations depending on special infrastructure setup. The solution does allow for adaptation to highly complex and security restricted infrastructures involving e.g. a Web proxy or NTLM authorization server, but it is out of scope of this guide to elaborate on. If you run into problems, then do not hesitate to contact us and we will guide you in the right direction, or help you troubleshoot. You can also consult our document library here: or the FAQ section here: Secomea GateManager5 BASIC Guide Page 5 of 26

6 SiteManager Installer 2. ROLE: SiteManager Installer You should have received a new un-configured SiteManager unit. UPLINK2 UPLINK2 (requires an installed USB Wifi adapter or Broadband modem) UPLINK1 UPLINK1 DEV DEV 2.1. Configure GateManager settings using the Appliance Launcher Hint: The steps in this section can actually be performed before sending the SiteManager to its final destination. 1. Download and install the Secomea Appliance Launcher from this location: 2. Use a standard Ethernet cable to connect the SiteManager s Ethernet Uplink/Uplink1 port to your local network. (Alternatively you can connect directly your PC LAN port to the SiteManager s Uplink port using an Ethernet cable. Both standard and cross-wired cables will work) 3. Connect power wires to the SiteManager screw terminals according to the leaflet included in the SiteManager package. 4. Power on the SiteManager, and wait about 30 seconds. Secomea GateManager5 BASIC Guide Page 6 of 26

7 SiteManager Installer 5. Start the Appliance Launcher program, if the SiteManager does not appear immediately; press the Search button repetitively until the SiteManager appears. 6. Click Next to get to the LAN/DEV1 configuration page. For now, we do not need to do anything here. We can configure this remotely via the LinkManager later if needed. Secomea GateManager5 BASIC Guide Page 7 of 26

8 SiteManager Installer 7. Click Next to enter the WAN/UPLINK page. Since we assume the SiteManager to be connected to your corporate network, you can leave the setting to DHCP, and it will automatically get an IP address and a default gateway from your corporate DHCP server. 8. Click Next to enter the WAN2/UPLINK2 page. This is only used for configuring a broadband or WiFi Uplink. Hint: If you already now have decided to use the 3G/GPRS option, you should just enter the Pin code of the SIM card here. Note that you can always enter this information via the SiteManager web GUI later. Secomea GateManager5 BASIC Guide Page 8 of 26

9 SiteManager Installer 9. Click Next to get to the GateManager Parameters page. IMPORTANT: The information to enter in this screen is found in the you received from the GateManager with the GateManager X.509 Certificate. Secomea GateManager5 BASIC Guide Page 9 of 26

10 SiteManager Installer 10. For the GM Appliance Name you should decide a meaningful name, such as the location of the SiteManager. For example SiteA 11. Click Next to get to the Finish screen, Check the box to preserve password: Note: by selecting preserve password the password for local login to the administration Web interface of the SiteManager will remain admin. If unchecked the password will be changed to the SiteManager s MAC address. Logging in to the SiteManager via the LinkManager does not require password. Secomea GateManager5 BASIC Guide Page 10 of 26

11 SiteManager Installer 12. When clicking Save/Reboot you should get the following page (if not, you can try to click Back to the first screen, and click Next again until the Save/Reboot screen) appears. 13. If the SiteManager has received a DHCP assigned IP address, and either port 11444, 443 or 80 are allowed Internet access with SSL/TLS encryption by the network firewall, the SiteManager will now connect to the GateManager. Check the leaflet enclosed with your SiteManager for the LED signaling of GateManager Connected. If you are connecting via a 3G/GPRS modem connected to the Uplink2 USB port, the same LED status signaling will apply. You do not need to do more local to the SiteManager. In reality you could now ship the SiteManager to a new site. Once the Ethernet Uplink1 port is connected at the new site, or the Uplink2 port has connected to the WiFi access point or broadband provider, the SiteManager will receive a new DHCP address, and attempt connecting to the GateManager over the Internet. Secomea GateManager5 BASIC Guide Page 11 of 26

12 SiteManager Installer 2.2. Deciding a Device connection method Note: The SiteManager can also provide access to serial devices or USB devices, by attaching them to the RS232 DB9 connector, or the USB connector of the SiteManager. The following will concentrate on Ethernet devices only. 14. The typical way of deploying a SiteManager and the devices to be managed, is to utilize the SiteManager s ability to completely isolate the devices from the corporate network, like this (IP addresses are just examples): /24 IP HINT: The machine depicted as , can be attached through a switch, or directly with an Ethernet cable to a DEV port. Optionally, the SiteManager can be configured to assign the address to the devices on the DEV ports by DHCP. (/24 noted after after the IP address is just the standard TCP notation of a subnet mask of ) 15. You can, however, also monitor a device already on the corporate network (the Ethernet Uplink side), and no further network configuration of ports are required on the SiteManager (if you are using Uplink2 to connect a 3G/GPRS modem, you will have to connect equipment on the DEV port as shown above, and configure the DEV port IP settings correspondingly) / /24 NOTE: The machine depicted represents the network device you want to use as remote monitored device for this exercise. You can, however, use any IP enabled device, such as a PLC, HMI or even a PC or a printer. In the following we are using a PLC attached on the DEV side of the SiteManager. 16. IMPORTANT: /24 DO NOT CONNECT THE DEV AND UPLINK1 PORTS TO THE SAME PHYSICAL NETWORK /24 DO NOT ASSIGN DEV ADDRESS IN THE SAME LOGICAL NETWORK AS UPLINK1 Secomea GateManager5 BASIC Guide Page 12 of 26

13 GateManager BASIC Admin (LinkManager Account Administrator) 3. ROLE: GateManager BASIC Admin 3.1. Install the GateManager Administrator certificate 17. Locate the you received from the GateManager with the GateManager X.509 Certificate, and save the attached file to your My documents folder: 18. Open the link in the same . (There may be two links with a DNS name and IP address respectively and you can use either of them). 19. This will open the login screen of the GateManager: Note: The GateManager administrator portal requires minimum MS Internet Explorer 9, Apple Safari, FireFox or Google Chrome. 20. Select Choose File and browse for the certificate you just saved, and enter the password you were informed by the administrator. If you have not yet received the password via , SMS or verbally, you should take contact the person that is listed in the signature section of the with the certificate (do not hit reply on the , as it is auto-generated from the GateManager). Secomea GateManager5 BASIC Guide Page 13 of 26

14 GateManager BASIC Admin (LinkManager Account Administrator) 3.2. Create LinkManager user 21. When logged in select the Accounts tab, and select the + icon to create a new account 22. Fill in the following information The Account name. This will become the file name of the LinkManager certificate file (in this case Rose.lmc). Person Name, and optionally Mobile. In this exercise you will likely issue the account to yourself. You can later create accounts for other users (All users will share the same LinkManager floating license). Type a Password. If you create the account for another use, you should inform this password to the user verbally or in a separate . When pressing Save, the is automatically sent from the GateManager. Secomea GateManager5 BASIC Guide Page 14 of 26

15 LinkManager User 4. ROLE: LinkManager User 4.1. Install the LinkManager 23. The previous step has generated an from the GateManager that includes a LinkManager certificate (.lmc). Save the attached certificate to your computer. 24. Download and install the LinkManager software by clicking the appropriate link in the . IMPORTANT: You must have administrator privileges on the PC in order to install LinkManager. LinkManager will not work if installed on Windows running inside a VBox virtual machine. Always install LinkManager on the host OS. You can still run your programming software inside a virtual machine and connect to devices via the LinkManager on the host OS if the virtual machine is configured for NAT. 25. Eventually, when you click Finish in the installation wizard, the LinkManager icon will after a while turn green in your Windows system tray, and your default web browser will open, showing the LinkManager Web GUI. Hint: If The LinkManager icon remains yellow for a long while, it could indicate that something on the PC is preventing the LinkManager from starting correctly. Consult the FAQ here for trouble shooting info: Secomea GateManager5 BASIC Guide Page 15 of 26

16 LinkManager User 26. Browse for the certificate you just saved and enter the password you specified for the account in step 22: 27. When clicking Install, you will be prompted to login. Repeat the password from above, and click Login: Hint: If you get an error logging in the first time, try once more. This can happen in some cases with brand new accounts. Secomea GateManager5 BASIC Guide Page 16 of 26

17 LinkManager User 4.2. Connect to the SiteManager GUI 28. When you are successfully logged in via the LinkManager Console, you will get a menu where the left frame displays your domain on the GateManager. You will notice that it is the same domain as you defined earlier as GM Domain Token in the SiteManager. Subsequently the SiteManager should also have shown up in the right frame by the name you defined for it. In this case SiteA 29. Click the Globe icon next to the SiteManager to establish a connection to the SiteManager s configuration GUI. Secomea GateManager5 BASIC Guide Page 17 of 26

18 LinkManager User 4.3. Configure the SiteManager Network settings Note: If you want to connect to a device in the same network as the Uplink interface (ref. section 2.2), or if you want to connect a Serial or USB device to the SiteManager, you do not need to configure or connect anything to the DEV port of the SiteManager, and you can jump straight to section 4.4 on page 20. The following steps assume we want to connect a device to the DEV port of the SiteManager, and create a separated device network. 30. Unless your device has an IP address already in the default DEV network of the SiteManager ( /24) you must change the IP address of the DEV port on the SiteManager. IMPORTANT: This IP address must match the subnet of the device, and it must not, be in the same IP subnet as the Uplink port. Select Edit on the DEV port: 31. The PLC in our example has IP address /24 (/24 means it has subnet mask ). So the address for the DEV port must be a free address in this subnet ( x), for instance Select Save and Continue Setup Hint: If your device is configured to receive an IP address from a DHCP server, you could have enabled DHCP in this menu, which would make the SiteManager act as a DHCP server that assigns IP addresses to devices on the DEV network. You can even lock the DHCP lease to a device MAC address, so your device will always receive the same IP address. Secomea GateManager5 BASIC Guide Page 18 of 26

19 LinkManager User 32. Back in the Setup Assistance screen, you will notice that the SiteManager requires a reboot to activate changes (the new DEV IP address). Select Fix, and activate the reboot: Hint: If your browser does not seem to automatically reconnect, try hit F5 occasionally to see if has come online. Secomea GateManager5 BASIC Guide Page 19 of 26

20 LinkManager User 4.4. Configure the SiteManager Device Agent 33. The SiteManager Setup Assistant will indicate that no agents are configured. Select Fix 34. Click New to create a new agent. Secomea GateManager5 BASIC Guide Page 20 of 26

21 LinkManager User 35. In this example we have chosen a Siemens S300 PLC and the Device Type should subsequently be Siemens / Ethernet. Type an appropriate Device Name, and enter the IP address of the device. 36. Click Save and click the Refresh Button, until you see the agent go IDLE: Hint: If it does not go idle, it means the SiteManager does not get a response from the device, and you should check the configured IP addresses and Ethernet wiring again. 37. Locate the browser window with the LinkManager. Click Refresh in the top menu, and you will now notice a + sign that will expand the SiteManager: Secomea GateManager5 BASIC Guide Page 21 of 26

22 LinkManager User 38. Expand it and Click the text of the Agent to connect to it. 39. The agent will now open all relevant ports for programming this type of PLC. You now have IP access to the device from your PC through the LinkManager via the GateManager and SiteManager. You can therefore now connect directly to the IP address of the device using the native PLC software (in this example Siemens Step7 or the TIA portal). For more details, check the guides for different types of equipment in section D here: Secomea GateManager5 BASIC Guide Page 22 of 26

23 LinkManager User 40. Depending on the type of agent, you may also get a Globe icon that allows you to connect to the Web GUI of the device: 41. This will bring you straight to the local Web interface of the PLC: Secomea GateManager5 BASIC Guide Page 23 of 26

24 Summary 5. Summary If the IP address in the above example represented a PLC in your network, you would just have to configure this address in your PLC programming software; just as if you were sitting local to it. If you have performed this exercise with your LinkManager, SiteManager and the managed device connected to the same network, you may think: is the connection not just done directly, and not via the LinkManager, GateManager and SiteManager? In fact, all communication always travels encrypted via the GateManager, so no matter where you place the SiteManager and the PLC device on the Internet, you will get the same experience; the device will seem like it was placed local to your PC, and be represented by its true local IP address. You could even have all devices of a certain type placed on different sites use the same local IP address. This will allow you to have one PLC project with the same IP address for all PLCs. If you experienced that things worked out as described in this guide, we suggest you go ahead and deploy the SiteManager at a real production site, configure real industrial devices, and try it out using your own programming software. Everything is fully functional, and ready for production use! Secomea GateManager5 BASIC Guide Page 24 of 26

25 OPTIONAL: FULL GateManager Administator 6. Upgrading your GateManager Administrator account from BASIC to PREMIUM (P/N 26473) With your current GateManager BASIC account, you are only using the GateManager administrator account to manage your LinkManager accounts. You can, however, upgrade to GateManager PREMIUM and receive a Full GateManager administrator account. This upgrade will add the following features to your current account: Organize equipment in domains per customer, factory, access levels or other logical structure (create domains and drag and drop devices and SiteManagers into relevant domains). Give LinkManager accounts individual access to domains (all LinkManager accounts will, when logging in, pull a license from the same LinkManager floating license pool on the server). Distribute messages for LinkManager users, that are automatically displayed to the users when logging into LinkManager (it could notification of server maintenance). Get overview of status for all connected equipment, and have the possibility to apply alert rules that will result in reports when triggered (such as failed, connected etc.). Get access to audit logs for all equipment (who did what, when). Create an unlimited number of co-administrators for GateManager Console access. Administer all GateManager Console and LinkManager accounts, and for instance remove access for resigned employees, or define time limited access for certain accounts. You can order a GateManager PREMIUM account on Secomea part number Secomea GateManager5 BASIC Guide Page 25 of 26

26 Notices Publication and copyright Copyright Secomea A/S All rights reserved. You may download and print a copy for your own use. As a high-level administrator, you may use whatever you like from contents of this document to create your own instructions for deploying our products. Otherwise, no part of this document may be copied or reproduced in any way, without the written consent of Secomea A/S. We would appreciate getting a copy of the material you produce in order to make our own material better and if you give us permission to inspire other users. Trademarks SiteManager, LinkManager and GateManager are trademarks of Secomea A/S. Other trademarks are the property of their respective owners. Disclaimer Secomea A/S reserves the right to make changes to this publication and to the products described herein without notice. The publication of this document does not represent a commitment on the part of Secomea A/S. Considerable effort has been made to ensure that this publication is free of inaccuracies and omissions but we cannot guarantee that there are none. The following paragraph does not apply to any country or state where such provisions are inconsistent with local law: SECOMEA A/S PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE SECOMEA A/S SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGE ALLEGED IN CONNECTION WITH THE FURNISHING OR USE OF THIS INFORMATION. Secomea A/S Denmark CVR No. DK sales@secomea.com Page 26 of 26